22 ms·
Accidentally Stopping a Global Cyber Attack
- problems 9y agoHonestly, how stupid were the malware authors to use standard DNS for a domain that could take down their shit when they use Tor for the actual key and address communication and everything... it's like they half understood what they were doing. Well, I guess maybe they didn't want things to get too out of hand and now if they want they can be back up soon with that fixed.
- jacquesm 9y ago> it's like they half understood what they were doing. And that's exactly what is so wrong about the NSA and others not being good stewards of their own bloody malware. A lot of these criminals would not be able to get their act together at this level without being partially funded by the three letter agencies. Think of it as an advanced form of script kiddies, they can use the tools and wrap them but they could not come up with those tools of their own accord.
- pzduniak 9y agoIt's all explained in the article. It is a sandboxing detection method, some environments resolve all DNS requests to a host that captures all traffic. It's still stupid but there is a reason for this behaviour.
- gnyman 9y agoAs with all SW development, there are always a lot of things that they "could have" or "should have" but every day you wait with malware which has a know patch out means less spread for you. So they probably made the decision to just get it out as quickly as possible even if it was not perfect.
- viraptor 9y ago> how stupid were the malware authors to ... They were clever enough to execute this attack, collect over £160k according to the last estimate I've seen (likely way more now), and achieve that in one day. You seem to underestimate them including assumptions that this was simply missed. There are many potential scenarios where this is beneficial to the authors.
- taspeotis 9y agoI think it's great that this was used to stop the malware, but pre-emptively registering the domain without understanding what it did seems dangerous. The malware could have just as easily used the registration of that domain as a flag to start deleting data, no?
- sinaa 9y agoThis may indeed be exactly what the authors of the next ransomware will do. Two domains, one defuses the ransomware, the other detonates it.
- cesarb 9y ago> Two domains, one defuses the ransomware, the other detonates it. And one of the domains will be called redwire[randomchars].com, and the other bluewire[randomchars].com. Which one do you sinkhole, the red wire or the blue wire?
- eddyg 9y agoThis would be Very Bad if your ISP is one of those that intercepts NXDOMAIN responses and instead returns an A record to some other "helpful" thing... or some DNS provider that returns a "this site has been blocked by your administrators" page...
- tgb 9y agoThe article says this already is done in other malware.
- snowwrestler 9y agoYou just test both in a disposable environment, and then you know which one to sinkhole publicly. The researcher in this case registered the domain right away because he had experience that that creates a positive result. Once that sort of thing starts creating bad results, then researchers will start testing more carefully before grabbing domains.
- viraptor 9y ago
- deleted 9y ago[deleted]
- amelius 9y agoIt seems a bit scary that security researchers are relying on bugs in malware to get their job done.
- alex_duf 9y agoYet malware creators rely on bugs to spread their work, so why not. Fighting fire with fire...
- amelius 9y agoRight. But the problem is that malware creators can choose from many more attack vectors than security researchers typically can.
- deleted 9y ago[deleted]
- mannykannot 9y agoThere are many things in the current state of security to be worried about, yet complacency remains high (which is one of the things...)
- peterwwillis 9y agoHow is that scary?
- dis-sys 9y agoLessons learnt by ransomware developers - rather than using a single pretty arbitrary test, always rely on a more robust statistical model to detect whether your code is running inside a sandbox. Lessons learnt by NSA - never over estimate the skill level of your network admins. Lessons learnt by Microsoft - never under estimate the loyalty of your Chinese Windows XP users, both XP and Win10 have 18% of the Chinese market [1]. Lessons learnt by the Chinese central government - NSA is a partner not a threat, they build tools which can make the coming annual China-US cyber security talk smooth. [1] http://gs.statcounter.com/os-version-market-share/windows/desktop/china http://gs.statcounter.com/os-version-market-share/windows/de...
- frik 9y ago> Re your Statscounter link http://gs.statcounter.com/os-version-market-share/windows/desktop/china http://gs.statcounter.com/os-version-market-share/windows/de... Win 7 is rising again for months Win10 and WinXP are shrinking
- dis-sys 9y agoIt is normal to see such data move +/-1% in a few months time. It is far more shocking to see 18% windows users in China are still running their XP. Must be very easy for NSA to do their job.
- tomc1985 9y agoThen you really don't want to see South America... a few years ago every PC I saw at a business ran XP.
- lovich 9y agoWhen I visited a firm we had contracted out with in India they also had machines running xp right next to machines running Windows 10 for our project
- toyg 9y agoThe elephant in the room is that XP was the last version of Windows that was relatively trivial to pirate. Activation procedures got stricter from 2008 onwards.
- johnchristopher 9y ago> After about 5 minutes the employee came back with the news that the registration of the domain had triggered the ransomware meaning we’d encrypted everyone’s files (don’t worry, this was later proven to not be the case), but it still caused quite a bit of panic. I contacted Kafeine about this and he linked me to the following freshly posted tweet made by ProofPoint researcher Darien Huss, who stated the opposite (that our registration of the domain had actually stopped the ransomware and prevent the spread). That's quite an high abstraction level programming thing to do to use a domain name registration state as a boolean. Is that a regular thing ?
- sinaa 9y agoThis may well give birth to a new paradigm: Domain-Driven Programming. Each condition is satisfied by a different domain lookup.
- Retr0spectrum 9y agoI'm not really sure what you're trying to say, but reading the rest of the article will answer your question.
- johnchristopher 9y agoOh come on, you did understand what I was saying otherwise you wouldn't know the article had more details about how it's a check to know if the code is being ran in a sandbox. There was no need for the condescending tone.
- deleted 9y ago[deleted]
- Retr0spectrum 9y agoAll I understood was that you seemed unsure about the purpose of the domain check, so I pointed you in the right direction. Sorry if that came off as condescending.
- jstoja 9y agoDoes someone know what this domain actually is? EDIT: After looking explicitly for it I found www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com.
- adolph 9y agoIs that a Welsh company?
- unit91 9y ago...says adolph. The Germans, however, use much shorter terms like "Rechtsschutzversicherungsgesellschaften". :-)
- lionyo 9y agoRechtsschutzversicherungsgesellschaften German Noun - insurance company which provides legal protection
- Scoundreller 9y agoMy guess was going to be left-handed bricklayers that wear blue hats. Close.
- movedx 9y ago"Llanfairpwllgwyngyllgogerychwyrndrobwllllantysiliogogogoch" - town in Wales. Edit: https://en.wikipedia.org/wiki/Llanfairpwllgwyngyll https://en.wikipedia.org/wiki/Llanfairpwllgwyngyll
- ptaipale 9y agoOff-topic, but I think that traditionally, the longest official word in German was "Rindfleischetikettierungsüberwachungsaufgabenübertragungsgesetz", the name for a law about testing and labeling of beef, now repealed. This word (63 letters) was of course not in everyday use by most people, but it was actually in the law.
- 9y ago
- DrNuke 9y agoSo from a practical point of view how to disentangle infrastructures from this sort of attack?
- z3t4 9y agoinstall security updates and do security hardering by whitelisting only what you need.
- dorfsmay 9y agoThe author says they are doing this for a living. Who are they working for?
- Kenji 9y agoYeah, I'd love to do that kind of stuff for a living. Not sure if I'd be good enough though. I'm fluent in x86 assembly and do quite a lot of debugging on that level, but reverse engineering remains a tough problem.
- ambicapter 9y agoProbably freelance consulting for companies who really want to keep their stuff protected from this sort of thing.
- Scoundreller 9y agoThat's where the real money is in malware. This malware group may have made $30k on the attack, but the malware-protection industry will earn orders of magnitude more business.
- icpmacdo 9y agoHe's a great follow on Twitter, he works for some cyber security company in LA I think but lives in England. Got offered the job after he created a Mira bot tracker IIRC.
- Cyph0n 9y agoAgreed. I've been following him for a few years now, very interesting account.
- imsodrunklol 9y agoHandle?
- icpmacdo 9y ago
- jedisct1 9y agoIronically, lying DNS resolvers redirecting nonexistent domains to ads were also helpful in order to mitigate the attack.
- raverbashing 9y agoDNS being one of the most fragile aspects of the net, a lot of issues can be solving by a local DNS resolver that does a lot of caching and blocking
- jedisct1 9y agoSure, and something like dnscrypt-proxy can do that, but in what is being discussed here, blocking the domain would do the opposite of what you are trying to achieve. The ransomware prematurely quits if the domain resolves to an IP, and a webserver listens to that IP.
- theoh 9y agoRemember that time when VeriSign did this (wildcarding) on a global basis for .com and .net in 2003, briefly causing outrage? "As of a little while ago (it is around 7:45 PM US Eastern on Mon 15 Sep 2003 as I write this), VeriSign added a wildcard A record to the .COM and .NET TLD DNS zones. The IP address returned is 64.94.110.11, which reverses to sitefinder.verisign.com. What that means in plain English is that most mis-typed domain names that would formerly have resulted in a helpful error message now results in a VeriSign advertising opportunity. For example, if my domain name was 'somecompany.com,' and somebody typed 'soemcompany.com' by mistake, they would get VeriSign's advertising." https://m.slashdot.org/story/38665 https://m.slashdot.org/story/38665
- kuschku 9y agoEven today, T-Mobile still does that – any domains that can not be resolved are redirected to their ads.
- 9y ago
- aqsheehy 9y agoSo will companies start holding bitcoin as insurance on these kinds of attacks?
- viraptor 9y agoNo. Paying doesn't guarantee you recover your data or that you won't get hit again. If you're getting to the stage where you're dealing with contracts and money, implementing a backup system is likely a simpler solution. Also btc price is a bit unpredictable. Would you really risk buying it ahead of time, not knowing if you'll ever need it? What if the price goes down and you need to buy extra anyway? Apart from very specific situations it just isn't a great investment.
- mmalone 9y agoI'm sort of bearish on most things blockchain but this seems like one of a very small number of things that zero-trust auto-executing contracts could be useful for. Someone could probably work out a mathematical proof of "if you transfer this much etherium the private key will be decoded." Heh.
- matthewbauer 9y agoThat's a lot of work for little reward, I think. Most of the time the idea is that the hackers have every incentive to decrypt or else word will spread that it doesn't work even if you pay so people will stop paying.
- devrandomguy 9y agoBrown hat hackers have an incentive to create non-functional ransomware, to spread FUD on the legitimate ransomware. If news spreads that some ransomware does not actually decrypt the files after payment, then potential victims would have a stronger incentive to secure their systems, and a weaker incentive to stockpile ransom funds (wt actual f!) Then, the onus would once again be on the legitimate ransomware developers to prove their ability to do business, and some sort of Ethereum based automated contract might be an ideal tool for that.
- shimon_e 9y agoNow is the time to write a virus that uses the same exploit and automatically patches the vulnerable before a new version of the ransomware is released.
- viraptor 9y agoYou may want to read CFAA rules (https://en.m.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act https://en.m.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act) first. Breaking into someone's computer to fix it is still breaking into someone's computer and very illegal.
- shimon_e 9y agoThe Government can hire developers to do it themselves.
- daddyo 9y agoNot in all jurisdictions, per https://en.wikipedia.org/wiki/Negotiorum_gestio https://en.wikipedia.org/wiki/Negotiorum_gestio > Negotiorum gestio (Latin for "management of business") is a form of spontaneous voluntary agency in which an intervenor or intermeddler, the gestor, acts on behalf and for the benefit of a principal (dominus negotii), but without the latter's prior consent. The gestor is only entitled to reimbursement for expenses and not to remuneration, the underlying principle being that negotiorum gestio is intended as an act of generosity and friendship and not to allow the gestor to profit from his intermeddling. This form of intervention is classified as a quasi-contract and found in civil-law jurisdictions and in mixed systems (e.g. Scots, South African, and Philippine laws). > For example, while you are traveling abroad, a typhoon hits your home town and the roofing of your house is in danger. To avoid the catastrophic situation, your neighbour does something urgently necessary. You are the 'principal' and your neighbour here is the 'gestor', the act of which saved your house is the negotiorum gestio.
- viraptor 9y agoI'd be happy to be proven wrong, but I don't think it applies here. Specifically, nothing in this summary indicates that you can break other laws to fulfill this one. IANAL, etc.
- rochak 9y agoDoes this mean that I can safely connect my outdated Windows 7 back to the internet?
- tomlong 9y agoSure
- hetfeld 9y agoKappa
- Retr0spectrum 9y agoNo! All it takes is a single byte to be patched and the "killswitch" can be disabled. There are almost certainly other variants already in circulation. Use an offline security update.
- goda90 9y agoDisable SMBv1 before you connect it!
- rochak 9y agoAre there any side effects of disabling SMBs for your local machine that you won't be using to connect to network drives?
- deanclatworthy 9y ago
- CombinatorWhy 9y agoInteresting timing for this cyber attack given the recent news. Are Robert Mercer and Cambridge Analytica also being investigated?
- m-j-fox 9y agoI'm curious, does anyone know what tool he uses to disassemble the program into C? It looks neat.
- mschuster91 9y agoThat's HexRays in IDA. Pretty nice but damn expensive.
- deleted 9y ago[deleted]
- homero 9y agoWas the domain ever named? Found it www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
- deleted 9y ago[deleted]
- remx 9y agoTo mitigate, I am running Debian as the host and jailing Windows 10 in a Virtual Machine, and have uninstalled SMB1.0 on the machine by going into > Programs and Features > Add or Remove Windows Components. I have also blocked port 445 (SMB) with ufw (On Debian) sudo ufw deny out to any port 445 Aswell as this I am not deferring updates in any way and dutifully patching. I've always hardened Windows in this way and I've never had issues with malware, and if I did, the impact would be minimal because I've compartmentalized my files in such a way that even the worst malware would only encrypt some of my files and not all of them. I store all my critical files in an offline environment (sandbox) so the only files that are going to be encrypted are replaceable (non important) and disposable. For example, I wouldn't cry if my C.V got encrypted because a copy of it exists in about 50 locations either offline and online. Unfortunately I need Windows because my colleagues like to send Windows-only .DOCX files which work best in MS Word, and I don't have a Google account, so I can't open them in Docs. This is a conscious decision to permaban Google from my life, but Windows is staying.
- julianh95 9y agoWhy not just use Apache open office?
- remx 9y agoThanks for the tip, and I will try this. As I said, .DOCX files work best in their native Win Office environment as I've had problems with them in open source solutions (formatting issues), whitespace injection ruining the layout, etc
- unlmtd 9y agoGo all the way and ban windows. You won't regret it, I promise. Run msword with wine?
- edwintorok 9y agoInstalling the crosextra fonts have improved the viewing of some .pptx for me: https://wiki.debian.org/SubstitutingCalibriAndCambriaFonts https://wiki.debian.org/SubstitutingCalibriAndCambriaFonts
- dperfect 9y ago> the employee came back with the news that the registration of the domain had triggered the ransomware meaning we’d encrypted everyone’s files... Even though this fortunately turned out to be false, what if it had been true? Would the security researcher be held in any way accountable for activating the ransomware? If I were the author, I might be a bit more careful in the future before changing factors in the global environment[1] that have the potential to adversely affect the malware's behavior, but of course I'm not a security researcher, so I really don't know. [1] I suppose a domain could probably be made to appear unregistered after being registered - depending on the actual check performed - but there are other binary signals (e.g., the existence of a certain address or value in the bitcoin blockchain) that might not be so easy to reverse.
- campuscodi 9y agoThe ransomware was already active for hours by that point. The answer the employee provided did not make any sense. Not now, not the first time I read the blog.
- dangero 9y agoIt's an interesting thought experiment. The closest analogy I can think of is pulling the wrong wire on a bomb.
- FLUX-YOU 9y agoThat's what bugs me about the blog post but it may only be an issue with how it's written or my understanding. From the Talos Intelligence blog: >The above subroutine attempts an HTTP GET to this domain, and if it fails, continues to carry out the infection. However if it succeeds, the subroutine exits. It's not clear if the subroutine being shown is the main entry point in which case return 0 exits (which is good for us), or if it's part of a larger framework that would be doing stuff later on (which is potentially bad for everyone because it could decide to do other things if it finds that domain sinkholed?) The blog author checked on whether or not the domain name changes, but didn't specify any details about anything going on higher in the stack: >All this code is doing is attempting to connect to the domain we registered and if the connection is not successful it ransoms the system, if it is successful the malware exits (this was not clear to me at first from the screenshot as I lacked the context of what the parent function may be doing with the results). So my question is how much knowledge did they have of the rest of the code when registering the domain? Would the analysis environment have provided more information if the malware had continue to run after realizing the domain was sinkholed?
- trendoid 9y ago>In certain sandbox environments traffic is intercepted by replying to all URL lookups with an IP address belonging to the sandbox rather than the real IP address the URL points to, a side effect of this is if an unregistered domain is queried it will respond as it it were registered (which should never happen). Can someone please explain this? I have no idea what was said there.
- godmodus 9y agoPrivate dns server connected to the vm malware host
- mmalone 9y agoIn a sandbox environment (e.g., in a lab trying to deconstruct malware) they'll have a private DNS infrastructure setup to resolve all domains to some local IP address. That way they can intercept and reverse engineer the command & control traffic. The author of this malware tried to slow down security analysts by trying to resolve a "fake" (unregistered) domain. Probably just pounded on the keyboard and added a .com. The idea is that the domain should not resolve. If it does, it's an indication that they're in a sandbox / lab environment so the malware doesn't trigger. Again, this is an attempt to slow down analysis. Of course this was a stupid tactic because registering the domain and setting up DNS stopped the malware from triggering globally.
- SimeVidas 9y agoCan a Windows laptop that doesn’t have the Windows Update patch get infected just by being connected to the Internet via a home Wi-Fi network?
- ufmace 9y agoThat would be fine, as all commercial home routers firewall off access to the SMB service that is being exploited.
- ufmace 9y agoWhat really amazes me about this attack is that the main attack vector seems to be exploiting a SMB vulnerability. Reasonable enough of a way to spread within an organization, but it's amazing that so many organizations seem to have this port and service open to the world for this worm to exploit. I'm not the most diligent follower of security news, but I'm pretty sure that SMB network sharing is riddled with security vulnerabilities, latency issues, etc, and is generally wildly unsuitable for being left wide open to the entire internet. How could any institution with a competent IT department not have had this service firewalled off from the net for years?
- supermatt 9y agoIt only spread through SMB shares where available. Other vectors include downloaded executables (email, web, etc).
- dhd415 9y agoThe attack was usually introduced via a phishing attack and then spread through SMB vulnerabilities. It generally wasn't that SMB endpoints were open to the internet.
- ufmace 9y agoCertainly possible, but if it was spread with an ordinary phishing attack, I gotta wonder why all of these organizations got hit so hard in such a short timeframe. We've had lots and lots of conventionally spread ransomware attacks go out, but I don't know of any that have had this kind of effect in this timeframe.
- y_u_no_rust 9y agowindows defender exploit though or a preexisting nsa implant
- joelhaasnoot 9y agoCould it be organisations sharing data by SMB infecting each other?
- deleted 9y ago[deleted]
- noamhacker 9y ago> "One thing that is very important to note is our sinkholing only stops this sample and there is nothing stopping them removing the domain check and trying again, so it’s incredibly importiant that any unpatched systems are patched as quickly as possible." (A very important point at the bottom of the article)
- wand3r 9y agoGreat write-up. It's funny; a mistake/exploit allowed the malware; a mistake/bug allowed it to be mitigated...by the researchers mistaken intent that registering the domain would simply provide him with sample data.
- lordnacho 9y agoPretty interesting, if I'm reading it correctly the existence of the domain is checked, and if is there, the program is aborted, in order to stop sandbox analysis. I was wondering why they didn't just do a simple variant: 1) Instead of relying on DNS, which anyone can create, why not make a user account on some well known forum site. Like HN or Reddit. 2) Open the site, look for the user's page, and check his message titles by hashing them against some hash that can be in your code. 3) Detonate if you don't see the code, or the user account doesn't exist. This would have the useful characteristic that you could start/stop the attack using just an internet browser, anywhere. And the code word that you are after would be crypto hashed, so the defenders would have to find your keyword somehow from the hash. Heck, you could confound everyone by turning the thing on or off according to location, time of day, and so on. For extra points make it a blockchain thing. They're already using that for payment, right?
- space_fountain 9y agoMy understanding is the idea is more to check if a non registered domain behaves as if it was registered. Some sandboxing methods apparently lead to this for some reason.
- aji 9y agoor instead of relying on the domain name existing, look at the contents of the web page
- fooey 9y agoor just check against a handful of www.{{UUID}}.com domains instead of hard coding anything
- LastZactionHero 9y agoSometimes you've got a deadline and you just have to ship it.
- stordoff 9y agoReddit has been used to point to C&C servers in the past[0], so I wouldn't be surprised if some malware does send commands directly via Reddit. [0] https://www.intego.com/mac-security-blog/iworm-botnet-uses-reddit-as-command-and-control-center/ https://www.intego.com/mac-security-blog/iworm-botnet-uses-r...
- ChairmanPao 9y agoHe didn't really stop it. He slowed it down a bit.
- jwilk 9y ago"Please turn JavaScript on and reload the page." Uh, no. Here's an archived copy: https://archive.fo/BhLZn https://archive.fo/BhLZn
- Cole_Jontrane 9y agoWell, it didn't really stop it. It slowed it for a little bit, and then it was modified and spread again. I also wonder if now ransomware developers will leave red-herrings in the code where if the wrong domain is registered, it will do something more destructive. It's like knowing which wire to cut when you're defusing a bomb!
- techbubble 9y agoWonder how much longer it would have taken to understand the impact if he had just modified the hosts file instead of registering the domain?
- a-dub 9y agoImagine how bad it would have been if someone actually competent had chosen to weaponize one of the NSA exploits? This seems to have script kiddie written all over it.
- Safety1stClyde 9y agoAll I see here is "Please turn on Javascript and reload the page".
- patrickaljord 9y agoNot surprising to see 14 year old unpatched software connected to the internet being hacked like that. At least, the ones in charge of budgeting these upgrades should pay a price for failing at doing so, the users are obviously innocent victims.
- nneonneo 9y agoSadly, the malware author(s) have updated their code and are now spreading a variant without the "kill-switch" domain check: https://motherboard.vice.com/en_us/article/round-two-wannacry-ransomware-that-struck-the-globe-is-back https://motherboard.vice.com/en_us/article/round-two-wannacr... However, MalwareTech's sinkhole intervention has bought enough time for patches to be pushed out, so at this point it is absolutely imperative that everyone apply these patches as soon as possible.
- lucio 9y agoKudos to MalwareTech, but they could have delayed a month or so this publication.
- dejawu 9y agoHow reasonable is it to say that NSA are at least in part responsible for deaths resulting from the NHS crisis, since the ransomware is using their exploit?
- unlmtd 9y agoNSA is responsible for lots of deaths - that's their function.
- sdfhbdf 9y agoSomewhat reasonable. NSA can be held accountable for not disclosing a vulnerability responsibly but this exploit may have been found anyway by the creators of this ransomware. There is no one person/group/institution to blame here. It's multiple vectors that failed. Are there any reports that connect deaths of patients directly to this ransomware attack?
- deleted 9y ago[deleted]
- rixtox 9y agoCan someone write a patch worm that spread and fix the bug by exploiting the bug itself?
- jecjec 9y agoThis is not accidental. Not even close! This story, if true, details a person who profiled this malware and correctly logged the network requests it was making and then correctly identified a fundamental vulnerability in the software. This is not an accident at all - it is rather a profile in supreme competence. We should recognize it as such.
- jeroenhd 9y agoAlthough the domain name registration was intentional, activating the kill switch wasn't. The author registered the domain name without knowing what would happen (the virus might as well have wiped the entire disk) and was surprised to see that he had activated a kill switch. That's the accidental part.
- corford 9y agoHappy outcome but could have so easily gone the other way. Surely it would have been been more responsible to locally fake the registration of the domain first (apparently as easy as modifying /etc/hosts in this case) given he had no idea how the payload would respond? o_O Not sure I'd be singing his praises if his rash decision had triggered the deletion of the encrypted files.
- yjgyhj 9y agoWhy do operating systems allow users to run any executable? For programmers it's important to be able to - but when you're not coding, running any executable is not required. It should be that all programs are in /usr/bin & the others. Only root can write there. Users shouldn't be able to run any program that is located anywhere else. And this would be no problem. Am I wrong?
- ddalex 9y agoMost of the machines out there are single user, and managed by that user, not by a professional sysadmin. As such, the user has the needed access (root) to install any programs that they want, and all modern OSes allow only the admins to install programs. We already put multiple warning messages when a user decides to execute a suspicious binary, and yet everyone still clicks through any prompt without the second thought ? What's your suggestion that a). allows any user to have the machine installed and configured as he wants? and b). do not allow random programs from executing ?
- Myrmornis 9y agoOn Monday, are some governments going to have to make a statement on what they advise owners of infected computers to do?
- tripzilch 9y agoOne of the comments (under the article) is very apt: better wording would have been to say "serendipitous" instead of "accidental". This guy is sort of a hero, IMO. Given that this is affecting healthcare systems, he might very well have actually saved a bunch of lives! I hope he slept well, totally deserved it :)
- emiliobumachar 9y agoOff-topic: what is the site doing "checking your browser" for five seconds before showing the content? I know that this sort of data can be valuable - what browser I use, which plugins are there - but I just assumed everyone was doing this in negligible time frames. What more is there to check in a browser?
- asperous 9y agohttps://blog.cloudflare.com/when-the-bad-guys-name-malware-after-you-you/ https://blog.cloudflare.com/when-the-bad-guys-name-malware-a...
- jayflux 9y ago> In certain sandbox environments traffic is intercepted by replying to all URL lookups with an IP address belonging to the sandbox rather than the real IP address the URL points to, a side effect of this is if an unregistered domain is queried it will respond as it it were registered (which should never happen). Is this something VMs do? Does anyone have more info on this?
- jondubois 9y agoIt sounds like the mere existence of a specific DNS A record was the kill switch for the ransomware. That seems like a pretty bad kill switch, surely the attacker should have required some sort of password to deactivate the ransomware.